Add helmet security headers optionally configured in .env, as well as always hiding Express powered by msg